💻 computer science

Privacy as Permissible Operations: An ABAC Framework for Policy-Law Compliance

This paper introduces APLiance, a novel Attribute-based Access Control (ABAC) framework that models privacy laws and organizational policies to automatically verify policy compliance with legal requirements, demonstrated through the implementation of a browser plugin for India's Digital Personal Data Protection Act.

Original authors: Ajay Dhakar, Arunesh Sinha, Shamik Sural

Published 2026-04-15

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Ajay Dhakar, Arunesh Sinha, Shamik Sural

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are walking into a giant, high-tech supermarket. Before you can buy a single item, the manager hands you a massive, 50-page contract written in a confusing mix of legal jargon and tiny font. It says things like, "By entering, you agree to let us sell your name to anyone who asks, forever, even if you leave the country."

You don't have time to read it, and even if you did, you wouldn't understand it. But you know that the government has passed a new law saying, "Hey, companies can't just take your data without asking nicely, and they have to tell you exactly what they'll do with it."

The Problem: How do we check if that giant contract actually follows the government's new rules without hiring a team of lawyers for every single website you visit?

The Solution: This paper introduces a smart system called APLiance. Think of it as a "Privacy Policy Translator and Enforcer."

Here is how it works, broken down into simple concepts:

1. The "Traffic Light" System (ABAC)

The researchers used a concept called Attribute-Based Access Control (ABAC). Imagine a traffic light system, but instead of just "Red" and "Green," it looks at specific details (attributes) to decide if a car can pass.

The Law as the Traffic Rules: The new Indian privacy law (DPDP Act) is translated into a set of strict "If-Then" rules.
- Example Rule: "IF the company wants to use your data, THEN they must have your clear 'Yes' (Consent) AND they must tell you exactly why."
The Policy as the Driver's Request: A company's privacy policy is treated as a request to drive through the intersection.
- The Check: The system asks, "Does this request have a valid 'Yes'? Is the reason clear?"
- The Verdict: If the policy meets all the "Green Light" conditions, it's Compliant. If it's missing a condition (like a clear "Yes"), it's Red Light (Non-Compliant).

2. The "Super-Translator" (The LLM)

Privacy policies are written in messy, human language. The law is written in precise, legal language. They don't speak the same dialect.

To fix this, the team used a Large Language Model (LLM)—basically, a super-smart AI that reads like a human.

The Job: The AI acts as a translator. It reads the messy privacy policy and extracts specific "facts" (attributes).
The Analogy: Imagine the AI is a detective looking at a messy crime scene (the policy). It ignores the fluff and asks: "Did they say 'Yes'? Is the language clear? Can I cancel this easily?" It turns the detective's notes into a clean checklist that the Traffic Light system can understand.

3. The "Browser Detective" (The Plugin)

The researchers didn't just build this for a lab; they built a browser extension (a plugin you install on Chrome or Firefox).

How it works: When you visit a website's "Privacy Policy" page, you click the plugin icon.
The Magic: The plugin instantly reads the page, sends it to the "Super-Translator," checks it against the "Traffic Light" rules, and gives you a simple report: "This policy is mostly compliant, BUT they forgot to tell you how to cancel your subscription easily."

4. What Did They Find? (The Reality Check)

The team tested this on 25 real-world websites (like shopping sites, news apps, and streaming services). Here is what they discovered:

Nobody is Perfect: None of the 25 websites were 100% compliant with the new law yet.
The Common Mistakes:
1. The Language Barrier: The law says privacy notices should be available in many local languages (like Hindi, Tamil, etc.). Most websites only had them in English.
2. The "Hard to Cancel" Trap: The law says it should be just as easy to stop sharing your data as it is to start. Most websites made signing up easy (one click) but making you stop required sending an email or calling a phone number.
3. The "Silent Yes": Some policies assumed you agreed just because you visited the site. The law requires a clear, active "Yes" (like checking a box).

Why This Matters

Think of APLiance as a compliance flashlight.

For Regular People: It shines a light on the dark corners of privacy policies, telling you, "Hey, this company is breaking the rules, be careful."
For Companies: It helps them see exactly where they are failing so they can fix it before they get in trouble with the law.
For the Future: It proves that we don't need to read 50-page contracts anymore. We can use smart tools to automatically check if our digital rights are being respected.

In a nutshell: This paper built a robot lawyer that reads privacy policies, checks them against the law, and tells you if you're safe or if the company is trying to sneak something past you. It's a first step toward making the internet a fairer place for everyone.

1. Problem Statement

The rapid proliferation of digital services has led to a significant gap between user privacy expectations and the complex, quasi-legal language of organizational privacy policies. Users often cannot comprehend these policies, and enterprises struggle to ensure their policies strictly comply with evolving privacy laws.

The Core Challenge: Translating unstructured natural language in privacy laws (e.g., the Digital Personal Data Protection (DPDP) Act of India) and privacy policies into a unified, machine-verifiable representation.
The Gap: Existing frameworks often lack a formal operational model to determine if a specific data operation described in a policy is legally permissible under a specific law. There was no prior work specifically addressing compliance checking for India's newly enacted DPDP Act.

2. Methodology: The APLiance Framework

The authors propose APLiance (ABAC framework for Policy–Law Compliance), a novel approach that models privacy compliance as an Attribute-Based Access Control (ABAC) problem. Instead of treating privacy as a static rule, it is modeled as a decision on whether a specific "operation" on personal data is permitted given the context.

A. Formal Modeling

The framework maps legal requirements and policy clauses into an ABAC structure:

Access Request ( $t$ ): Defined as a tuple $(s, o, a, e)$ $(s, o, a, e)$ representing Subject, Object, Action, and Environment.
- Subject: Data Fiduciary (organization) and Data Principal (user).
- Object: Personal Data.
- Action: Data Processing.
- Environment: Contextual factors (e.g., location, purpose).
Attribute Types:
1. Base Attributes: Values directly extracted from the privacy policy text (e.g., "Is consent freely given?", "Is the purpose specified?").
2. Derived Attributes: Values computed from base attributes using logical rules (e.g., consent_preconditions_fulfilled = true if all base consent conditions are met).
3. Unknown Attributes: Runtime facts not specified in the policy (e.g., "Has the user actually withdrawn consent?"). The system evaluates these under all possible domain values to ensure robustness.

B. Compliance Logic

A policy is considered compliant if the "access requests" implied by the policy are permitted by the ABAC rules derived from the law.

Rule Extraction: The DPDP Act (specifically Sections 1–7 regarding consent and processing) is manually formalized into logical predicates (e.g., IF law_applicable AND lawful_purpose AND (consent_status == active OR legitimate_use), THEN allow_data_processing).
LLM Integration: Since privacy policies are unstructured text, the authors use Large Language Models (LLMs) to map policy text to the defined attribute schema. The LLM infers values for base attributes (True/False/Unknown) based on the policy content.

C. System Architecture

Manual Modeling: Legal experts extract attributes and rules from the DPDP Act.
LLM Extraction: An LLM (GPT-4o-mini) processes the target website's privacy policy to populate the attribute values.
Rule Evaluation: A rule engine evaluates the populated attributes against the formalized DPDP rules.
Output: A binary verdict (Compliant/Non-Compliant) with specific violation explanations.
Browser Extension: A publicly released plugin performs real-time checks on visited websites.

3. Key Contributions

First DPDP Compliance Framework: APLiance is the first work to formalize and automate compliance checking specifically for India's Digital Personal Data Protection (DPDP) Act.
ABAC Formalization: It introduces a novel paradigm of modeling both laws and policies within a unified ABAC framework, making privacy reasoning operational and explainable.
Hybrid LLM-Rule Approach: It effectively combines the flexibility of LLMs (for unstructured text extraction) with the rigor of rule-based systems (for deterministic compliance checking), mitigating the hallucination risks of pure LLM approaches.
Real-World Implementation: Development and release of a browser extension for real-time compliance verification.

4. Experimental Results

The system was evaluated on a dataset of 25 real-world privacy policies from various domains (e-commerce, social media, etc.), creating 400 (policy, attribute) pairs.

Attribute Extraction Accuracy:
- Overall Accuracy: 94.5%
- Precision/Recall: 96.1%
- The system performed perfectly on explicit attributes (e.g., purpose_of_processing, lawful_purpose) but struggled with implicit concepts (e.g., easy_consent_withdrawal, consent_is_unambiguous).
Compliance Findings:
- Zero Full Compliance: None of the 25 analyzed policies were fully compliant with the DPDP Act.
- Primary Violations:
  1. Multilingual Requirement: No policy provided notices in all languages listed in the Eighth Schedule of the Indian Constitution.
  2. Grievance Redressal: Most policies lacked specific mechanisms for complaining to the Data Protection Board.
  3. Consent Mechanisms: Many policies relied on implicit consent (violating "unambiguous" requirements) or made withdrawal difficult (violating "easy withdrawal" requirements).
Ablation Study (APLiance vs. Direct Prompting):
- When comparing APLiance (structured extraction + rules) against direct LLM prompting (asking the LLM to judge compliance directly), APLiance outperformed the direct approach.
- Example: For easy_consent_withdrawal, APLiance achieved 76% accuracy vs. 68% for direct prompting.
- Example: For consent_is_unambiguous, APLiance achieved 64% vs. 52% for direct prompting.
- Conclusion: Decomposing the task into structured attribute extraction significantly improves reliability.

5. Significance and Future Work

Societal Impact: With India's massive user base, this tool helps bridge the gap between complex legal requirements and user understanding, empowering users to identify non-compliant services.
Legal Utility: The framework provides a structured, explainable method for regulators and courts to analyze policy violations, moving beyond subjective interpretation.
Scalability: While currently focused on the DPDP Act, the ABAC framework is generic and can be adapted for GDPR, CCPA, or HIPAA.
Future Directions: The authors plan to extend the framework to cover the remaining sections of the DPDP Act, integrate multi-lingual support for the LLM, and explore applications in legal dispute resolution.

In summary, APLiance successfully demonstrates that privacy compliance can be transformed from a subjective legal analysis into a precise, automated decision problem by leveraging the formalism of Access Control and the semantic understanding of LLMs.